Oninit® Snooper — Testing and Validation
Every Snooper build is checked three ways before release: unit regression tests for the protocol decoders, a TLS smoke matrix run against the finished binary, and a standing micro-benchmark suite that guards the logging path against performance regressions. All three run in the same Red Hat compatible build environments the shipping binaries are produced in.
Build environments
| Target | Build environment | glibc | Unit tests | TLS smoke | Benchmarks |
|---|---|---|---|---|---|
| RHEL / Rocky 8 | Rocky Linux 8 | 2.28 | pass | 7 of 7 | pass |
| RHEL / Rocky 9 | Rocky Linux 9 | 2.34 | pass | 7 of 7 | pass |
The binary built for Rocky 8 requires only glibc 2.17 symbols and the system OpenSSL (1.1.1 or later), so it runs on Rocky 8 and 9 and on RHEL 8 and 9. Build for the oldest platform you need to support.
Unit regression tests
Six standalone suites exercise the decoders in isolation, with fixed input vectors and exact expected output:
- INT8 / BIGINT tuple decoding (
tuple-intfam). - GSKit
.sthstash decoding (gskit-stash), used for keystore-based TLS. - DRDA protocol support — DSS/DDM framing (
drda-ddm), codepoint lookup (drda-codepoint), SQL statement extraction (drda-sqlstt) and EBCDIC translation (drda-ebcdic). The framing vectors are derived from the published specification; statement extraction and the EBCDIC table are checked against captured traffic.
TLS smoke matrix
Seven end-to-end scenarios run against the finished oni_snoop
binary, each with a real TLS handshake:
| Scenario | What it proves |
|---|---|
| listen-only-tls | TLS terminated on the client side only. |
| full-terminate-reencrypt | TLS terminated on both legs, traffic decoded in between. |
| hostname-verify-pass | Server certificate whose name matches is accepted. |
| hostname-verify-fail | Server certificate whose name does not match is refused. |
| conssl-keystore-stash | GSKit keystore with stash file is read and used. |
| legacy-tls10-minversion | TLS 1.0 works only when explicitly enabled. |
| legacy-tls10-default-deny | TLS 1.0 is refused by default. |
Performance regression suite
Five micro-benchmarks characterise the event-logging path in isolation. They check ratios, not absolute speeds, because absolute timings depend on the machine. On every platform tested, the optimised paths held a clear margin over the approaches they replaced:
- Cached timestamp formatting is consistently faster than formatting each event from scratch.
- Batched log writes sustain roughly 30 times the throughput of per-record locking and writing.
- A single large write is several times cheaper than the equivalent run of small writes.
- Contention between concurrent writers stays within a few times the uncontended cost, far inside the suite's failure bound.
For end-to-end latency with a real Informix engine under load, see SQLI Protect Mode — Performance.
Caveats
- These suites validate the decoders, the TLS handling and the logging path. They are not a substitute for running Snooper against your own traffic; start with a short capture on a non-production client.
- Benchmark figures vary from run to run and between machines. The suite fails only on a pathological regression, by design.